Improper input validation in Microsoft Windows and Windows Server - CVE-2017-11763

Vulnerability identifier: #VU8761

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-11763

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to input validation error the Windows font library improperly handles specially crafted embedded fonts. A remote attacker can trick the victim into visiting a specially crafted website and execute arbitrary code with privileges of the current user.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Microsoft Windows
Windows Server

Install updates from vendor's website.

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11763

• Multiple vulnerabilities in Microsoft Graphics Component